Privacy & Security
The court is public by design, but your account, your payments and the integrity of the throne are defended in earnest. Here is exactly what we hold, what the world can see, and how the kingdom is protected.
Data We Collect
Account data
Your email address (magic-link sign-in) or the identifier your OAuth provider (Google / GitHub) returns. We never store passwords.
Listing data
The canonical URL you submit, the title and description you give it, and its public bid history. The app never fetches the URL itself.
Payment metadata
The reference, status, amount and timestamps our payment providers (e.g. Stripe) return via webhook. Card numbers never touch our servers.
Operational logs
Rate-limiting counters keyed by user id or IP, and security/audit events required to operate and protect the service.
We do not sell personal data, and we do not run third-party advertising trackers. The formal, counsel-reviewed document is the Privacy Policy.
What Is Public
How Long We Keep It
- Leaderboard, listing and activity data is public by design and retained while the service operates.
- Financial records (bids, payments, state transitions) are retained permanently for audit and legal obligations, even if a listing is removed.
- Account data is retained while your account is active; the email address linked to financial records must be retained for record-keeping.
- Magic-link tokens expire after 15 minutes and single use; security logs are kept only as long as operationally necessary.
The Walls of the Keep
How We Protect the Court
Payments verified server-side
A bid activates only through a provider webhook whose HMAC-SHA256 signature is verified in constant time against the raw request body. A bad or missing signature means zero state mutation. Webhook handling is idempotent and runs inside serializable transactions.
Server-authoritative validation
URLs, bid amounts and every mutation are validated on the server. Client-supplied rank, status, title or cumulative totals are rejected outright; the leaderboard cannot be spoofed from the browser.
Hardened sessions
Sessions are JWTs in httpOnly, SameSite=Strict, Secure cookies signed with a server-side secret. Admin access derives solely from an internal database flag, never from the client. Magic-link tokens are single-use, short-lived, and stored only as hashes.
Integer-cents money
Every monetary value is an integer number of cents end-to-end. Floating-point money is banned by automated checks in the build pipeline. No rounding drift, ever.
SSRF-safe URL handling
Submitted URLs are normalised by a pure function that rejects non-http schemes and private, loopback, and cloud-metadata addresses. The service does not fetch submitted URLs.
Transport & headers
All traffic is served over HTTPS with HSTS and a restrictive Content-Security-Policy. Cross-origin form posts cannot reach mutation endpoints.
If you believe you have found a security vulnerability, please report it responsibly to the operator address published on this page rather than testing it against live data.
Requests & Contact
Depending on your jurisdiction you may have rights to access, correct, export or delete your personal data. Because leaderboard standings and financial records are public and audit-bound, deletion applies to account data, as verified bid records cannot be erased. Send requests, privacy questions and security reports to the operator address published at launch.